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Why GAO Did This Study 

The Visa Waiver Program, which 
enables citizens of participating 
countries to travel to the United 
States without first obtaining a 
visa, has many benefits, but it also 
has risks. In 2006, GAO found that 
the Department of Homeland 
Security (DHS) needed to improve 
efforts to assess and mitigate these 
risks. In August 2007, Congress 
passed the 9/11 Act, which provides 
DHS with the authority to consider 
expanding the program to 
countries whose short-term 
business and tourism visa refusal 
rates were between 3 and 10 
percent in the prior fiscal year. 
Countries must also meet certain 
conditions, and DHS must 
complete actions to enhance the 
program's security. GAO has 
examined DHS's process for 
expanding the Visa Waiver Program 
and evaluated the extent to which 
DHS is assessing and mitigating 
program risks. GAO reviewed 
relevant laws and procedures and 
interviewed agency officials in 
Washington, D.C., and in U.S. 
embassies in eight aspiring and 
three Visa Waiver Program 
countries. 



What GAO Recommends 



GAO recommends that DHS 
establish a transparent process for 
Visa Waiver Program expansion, 
and improve and monitor overstay 
rates for current and aspiring 
program countries. DHS generally 
agreed with GAO's 
recommendations. The Department 
of Justice (Justice) noted the 
importance of lost and stolen 
passport reporting, but did not 
comment on the recommendations. 

To view the full product, including the scope 
and methodology, click on GAO-08-967. 
For more information, contact Jess T. Ford at 
(202) 512-4128 orfordj@gao.gov. 



What GAO Found 

The executive branch is moving aggressively to expand the Visa Waiver 
Program by the end of 2008, but, in doing so, DHS has not followed a 
transparent process. DHS did not follow its own November 2007 standard 
operating procedures, which set forth key milestones to be met before 
countries are admitted into the program. As a result, Departments of State 
(State) and Justice and U.S. embassy officials stated that DHS created 
confusion among interagency partners and aspiring program countries. U.S. 
embassy officials in several aspiring countries told us it had been difficult to 
explain the expansion process to foreign counterparts and manage their 
expectations. State officials said it was also difficult to explain to countries 
with fiscal year 2007 refusal rates below 10 percent that have signaled interest 
in joining the program (Croatia, Israel, and Taiwan) why DHS is not 
negotiating with them, given that DHS is negotiating with several countries 
that had refusal rates above 10 percent (Hungary, Latvia, Lithuania, and 
Slovakia). Despite this confusion, DHS achieved some security enhancements 
during the expansion negotiations, including agreements with several aspiring 
countries on lost and stolen passport reporting. DHS, State, and Justice agreed 
that a more transparent process is needed to guide future program expansion. 

DHS has not fully developed tools to assess and mitigate risks in the Visa 
Waiver Program. To designate new program countries with refusal rates 
between 3 and 10 percent, DHS must first make two certifications. First, DHS 
must certify that it can verify the departure of not less than 97 percent of 
foreign nationals who exit from U.S. airports. In February 2008, we testified 
that DHS's plan to meet this provision will not help mitigate program risks 
because it does not account for data on those who remain in the country 
beyond their authorized period of stay (overstays). DHS has not yet finalized 
its methodology for meeting this provision. Second, DHS must certify that the 
Electronic System for Travel Authorization (ESTA) for screening visa waiver 
travelers in advance of their travel is "fully operational." While DHS has not 
announced when it plans to make this certification, it anticipates ESTA 
authorizations will be required for all visa waiver travelers after January 12, 
2009. DHS determined that the law permits it to expand the program to 
countries with refusal rates between 3 and 10 percent after it makes these two 
certifications, and after the countries have met the required conditions, but 
before ESTA is mandatory for all Visa Waiver Program travelers. For DHS to 
maintain its authority to admit certain countries into the program, it must 
incorporate biometric indicators (such as fingerprints) into the air exit system 
by July 1, 2009. However, DHS is unlikely to meet this timeline due to several 
unresolved issues. In addition, DHS does not fully consider countries' overstay 
rates when assessing illegal immigration risks in the Visa Waiver Program. 
Finally, DHS has implemented many recommendations from GAO's 2006 
report, including screening U.S.-bound travelers against Interpol's lost and 
stolen passport database, but has not fully implemented others. Implementing 
the remaining recommendations is important as DHS moves to expand both 
the program and the department's oversight responsibilities. 
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United States Government Accountability Office 
Washington, DC 20548 



September 15, 2008 

The Honorable Joseph I. Lieberman 
Chairman 

The Honorable Susan M. Collins 
Ranking Member 

Committee on Homeland Security and 

Governmental Affairs 
United States Senate 

The Honorable Dianne Feinstein 
Chairman 

The Honorable Jon Kyi 
Ranking Member 

Subcommittee on Terrorism, Technology, 

and Homeland Security 
Committee on the Judiciary 
United States Senate 

The Visa Waiver Program enables citizens of 27 participating countries to 
travel to the United States for tourism or business for 90 days or less 
without first obtaining a visa from a U.S. embassy or consulate. 1 The 
program has many benefits, including facilitating travel for millions of 
foreign nationals seeking to visit the United States each year. However, as 
we have reported, 2 the program also poses inherent security, law 
enforcement, and illegal immigration risks to the United States. In 
particular, Visa Waiver Program travelers are not subject to the same 
degree of screening as those with visas because they are not interviewed 
by a Department of State (State) consular officer before arriving at a U.S. 
port of entry. During the visa issuance process, State consular officers can 
determine if an individual has a criminal record or has prior immigration 
violations. On the basis of their assessments, consular officers decide 



'The participating countries are Andorra, Australia, Austria, Belgium, Brunei, Denmark, 
Finland, France, Germany, Iceland, Ireland, Italy, Japan, Liechtenstein, Luxembourg, 
Monaco, the Netherlands, New Zealand, Norway, Portugal, San Marino, Singapore, 
Slovenia, Spain, Sweden, Switzerland, and the United Kingdom. 

2 GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa 
Waiver Program, GAO-06-854 (Washington, D.C.: July 28, 2006). 
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whether to approve or deny a visa and, in doing so, help protect against 
individuals who pose a risk to the United States. Without the added 
safeguard of the visa issuance process, the Visa Waiver Program could be 
exploited to gain illegal entry into the United States. Indeed, in September 
2007, the Director of National Intelligence testified that al Qaeda is 
recruiting Europeans because most of them do not require a visa to enter 
the United States. Effective oversight of the Visa Waiver Program is 
essential to finding the right balance between facilitating legitimate travel 
and screening for potential terrorists, criminals, and others who may pose 
law enforcement and illegal immigration concerns. 

The executive branch aims to expand the Visa Waiver Program to 
countries in Central and Eastern Europe, and South Korea. According to 
the Department of Homeland Security (DHS), some of these countries are 
U.S. partners in the war in Iraq and have high expectations that they will 
join the program due to their close economic, political, and military ties to 
the United States. The executive branch has supported more flexible 
criteria for admission to the program. In August 2007, Congress passed 
legislation that allows DHS to consider admitting countries that otherwise 
meet the program's requirements but that have business and tourism visas 
refusal rates 3 between 3 percent and 10 percent, if the countries meet 
certain conditions, such as cooperating with the United States on 
counterterrorism initiatives. 4 Previously, only countries with refusal rates 
below 3 percent in the prior fiscal year qualified to be considered for 
admission. Before DHS can exercise this new authority, the legislation — 
referred to as the "9/11 Act" — requires that the department complete 
certain actions aimed at enhancing the security of the Visa Waiver 
Program. 

At your request, this report (1) examines the process DHS is following to 
admit countries into the Visa Waiver Program and (2) evaluates actions 
taken to assess and mitigate potential risks in the program. 

Throughout the course of our work, we reviewed laws governing the Visa 
Waiver Program and its expansion, and relevant regulations and agency 



The refusal rate refers only to the temporary business and tourism visa applications that 
are denied as a percentage of the total temporary business and tourism visa applications 
for nationals of that country. 

4 See Implementing Recommendations of the 9/11 Commission Act of 2007, 
Pub. L. No. 110-53. 
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operating procedures, as well as our prior reports and testimonies. We met 
with several DHS component agencies and offices, including Customs and 
Border Protection (CBP); Immigration and Customs Enforcement (ICE); 
the U.S. Visitor and Immigrant Status and Indicator Technology (US- 
VISIT); and the Visa Waiver Program Office, 5 which is responsible for 
oversight of Visa Waiver Program requirements. In addition, we 
interviewed officials from State's Consular Affairs, Europe and Eurasia, 
and East Asia and Pacific Bureaus, and met with International Criminal 
Police Organization (Interpol) officials in Lyon, France, as well as officials 
from the Department of Justice's (Justice) Interpol-U.S. National Central 
Bureau. 6 We also spoke with officials at U.S. embassies in three current 
and eight aspiring Visa Waiver Program countries. Appendix I contains a 
more detailed discussion of our objectives, scope, and methodology. We 
conducted this performance audit from September 2007 to September 
2008, in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 



RGSllltS in Brief ^ e execu ^ ve branch is moving aggressively to expand the Visa Waiver 

Program by the end of 2008, but, in doing so, DHS has not followed a 
transparent process. The department did not follow its own November 
2007 standard operating procedures, which set forth the key milestones 
that DHS and aspiring countries must meet before additional countries are 
admitted into the program. As a result, State, Justice, and U.S. embassy 
officials stated that DHS created confusion among its interagency partners 
and aspiring Visa Waiver Program countries. Indeed, absent clear direction 
from DHS, U.S. embassy officials in several aspiring countries told us that 
it had been difficult to explain the expansion process to their foreign 
counterparts and manage their expectations about when those countries 
might be admitted into the Visa Waiver Program. Furthermore, State 



5 DHS's Visa Waiver Program Office, known prior to September 2007 as the Visa Waiver 
Oversight Unit within the Office of International Enforcement, is led by a director, who 
reports to the DHS Assistant Secretary for Policy Development. 

The U.S. National Central Bureau in Washington, D.C., facilitates international law 
enforcement cooperation among the United States and Interpol and its other member 
countries. 
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officials said that it was difficult to explain to countries with fiscal year 
2007 refusal rates below 10 percent that have signaled interest in joining 
the program (such as Croatia, Israel, and Taiwan) why DHS is not 
negotiating with them. DHS, however, is negotiating with several countries 
that had fiscal year 2007 visa refusal rates above the 10 percent ceiling 
(Hungary, Latvia, Lithuania, and Slovakia), with the expectation that fiscal 
year 2008 rates will be below this ceiling. Nevertheless, DHS achieved 
some security enhancements to the Visa Waiver Program during expansion 
negotiations, including new agreements with several aspiring countries on 
lost and stolen passport reporting. DHS, State, and Justice agreed, 
however, that a more transparent process is needed to guide any future 
consideration of program expansion. In acknowledging weaknesses in the 
expansion process, DHS's Assistant Secretary for Policy Development said 
that DHS did not have a clear process at the outset of negotiations in late 
2007, in part because the department lacked prior experience in expanding 
the Visa Waiver Program and because the program's legislative 
requirements had changed in August of that year. 

DHS has not fully developed tools to assess and mitigate risks in the Visa 
Waiver Program. Specifically, DHS has not yet met two key certification 
requirements in the 9/11 Act that would allow DHS to consider admitting 
additional countries to the program with refusal rates between 3 percent 
and 10 percent. First, DHS must certify that it can verify the departure of 
not less than 97 percent of foreign nationals who exit from U.S. airports. In 
February 2008, we testified that DHS's plan to meet this provision will not 
demonstrate improvements in the air exit system and will not help the 
department mitigate risks of the Visa Waiver Program, because the plan 
does not account for data on those who remain in the country beyond 
their authorized period of stay (referred to as "overstays"). Second, DHS 
must certify that the Electronic System for Travel Authorization (ESTA) 
for screening visa waiver travelers in advance of their travel is "fully 
operational." DHS has not yet announced when it plans to make this 
certification; however, ESTA became available on a voluntary basis on 
August 1, 2008, and DHS anticipates that ESTA authorizations will be 
required for all visa waiver travelers after January 12, 2009. 7 DHS 
determined that the law permits it to expand the program to countries 
with refusal rates between 3 percent and 10 percent after it makes the two 



7 According to DHS, ESTA will be implemented as a mandatory program for all visa waiver 
travelers 60 days after publication of a notice in the Federal Register. DHS anticipates 
issuing that notice in November 2008, for implementation of the mandatory ESTA 
requirements on January 12, 2009. 
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9/11 Act certifications, and after the countries have met certain conditions, 
but before ESTA is mandatory for all Visa Waiver Program travelers. DHS 
may face challenges in implementing ESTA, such as adequately informing 
the public and travel industry about the system. In addition, for DHS to 
maintain its authority to admit certain countries into the program, the 9/11 
Act requires that the air exit system also incorporate biometric indicators 
(such as fingerprints) by July 1, 2009. However, DHS is unlikely to meet 
this timeline due to several unresolved issues. In addition, DHS does not 
fully consider countries' overstay rates when assessing illegal immigration 
risks in the Visa Waiver Program because the department's overstay data 
have weaknesses, according to the Visa Waiver Program Office. Finally, 
DHS has fully implemented many recommendations from our 2006 report 
aimed at improving DHS's ability to assess and mitigate program risks, 
including screening U.S.-bound travelers against Interpol's database of lost 
and stolen passports. However, DHS has not yet fully implemented others, 
such as requiring that all Visa Waiver Program countries report the theft or 
loss of blank and issued passports to the United States and Interpol. Fully 
implementing the remaining recommendations is important as DHS moves 
to expand both the Visa Waiver Program and the department's oversight 
responsibilities. 

To improve management of the Visa Waiver Program and better assess and 
mitigate risks associated with the program, we recommend that DHS 
establish a clear process, in coordination with State and Justice, for 
program expansion that would include the criteria used to determine 
which countries will be considered for expansion and timelines for 
nominating countries, security assessments of aspiring countries, and 
negotiation of any bilateral agreements to implement the program's 
legislative requirements. In addition, we recommend that DHS designate 
an office with responsibility for developing overstay rate information for 
the Visa Waiver Program, explore cost-effective actions to further improve 
these data's reliability, and use these validated data to help evaluate 
whether current or aspiring Visa Waiver Program countries pose a 
potential illegal immigration risk to the United States. 

We received written comments on a draft of our report from DHS and 
Justice, which we have reprinted in appendices IV and V, respectively. 
State did not provide comments on the draft. DHS either agreed with, or 
stated that it was taking steps to implement, all of our recommendations. 
Justice did not comment on our recommendations, but provided 
additional information about the importance of monitoring countries' 
reporting of lost and stolen passports to Interpol, and its efforts, in 
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collaboration with DHS, to include screening against Interpol's lost and 
stolen passport database in ESTA. 



BcLCkSrOlind * n a l mos t 13 million citizens 8 from 27 countries entered the United 

" States under the Visa Waiver Program. 9 The program was created to 

promote the effective use of government resources and facilitate 
international travel without jeopardizing U.S. national security. The United 
States last expanded the Visa Waiver Program's membership in 1999; since 
then, other countries have expressed a desire to become members. In 
February 2005, President Bush announced that DHS and State would 
develop a strategy, or "Road Map Initiative," to clarify the statutory 
requirements for designation as a participating country. According to DHS, 
some of the countries seeking admission to the program are U.S. partners 
in the war in Iraq and have high expectations that they will join the 
program due to their close economic, political, and military ties to the 
United States. As we reported in July 2006, DHS and State are consulting 
with 13 "Road Map" countries seeking admission into the Visa Waiver 
Program — Bulgaria, Cyprus, Czech Republic, Estonia, Greece, Hungary, 
Latvia, Lithuania, Malta, Poland, Romania, Slovakia, and South Korea. 

Following the terrorist attacks of September 11, 2001, Congress passed 
additional laws to strengthen border security policies and procedures, and 
DHS and State instituted other policy changes that have affected a 
country's qualifications for participating in the Visa Waiver Program. In 
August 2007, Congress enacted the 9/11 Act, which provides DHS with the 
authority to consider admitting into the Visa Waiver Program countries 
that otherwise meet the program requirements, but have refusal rates 
between 3 percent and 10 percent, provided the countries meet certain 
conditions (see app. II for worldwide refusal rates for fiscal year 2007). 
Before being admitted to the program, for example, the countries must 
demonstrate a sustained reduction in refusal rates, and must be 
cooperating with the United States on counterterrorism initiatives, 
information sharing, and the prevention of terrorist travel, among other 
things. In addition, DHS must complete two actions aimed at enhancing 
the security of the program (see app. Ill for the key legislative 



"This figure does not account for multiple admissions into the United States under the Visa 
Waiver Program by the same individual. 

9 The Immigration Reform and Control Act of 1986, Pub. L. No. 99-603, created the Visa 
Waiver Program as a pilot program. In 2000, the program became permanent under the Visa 
Waiver Permanent Program Act, Pub. L. No. 106-396. 
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requirements for inclusion in the Visa Waiver Program). In particular, to 
consider admitting countries into the Visa Waiver Program with refusal 
rates between 3 percent and 10 percent, DHS must certify the following to 
Congress: 

• A system is in place that can verify the departure of not less than 97 
percent of foreign nationals who depart through U.S. airports. Initially, 
this system will be biographic only. Congress required the eventual 
implementation of a biometric exit system at U.S. airports. If the biometric 
air exit system is not in place by July 1, 2009, the flexibility that DHS may 
obtain to consider admitting countries with refusal rates between 3 
percent and 10 percent will be suspended until the system is in place. 

• An electronic travel authorization system is "fully operational." This 
system will require nationals from Visa Waiver Program countries to 
provide the United States with biographical information before boarding a 
U.S.-bound flight to determine the eligibility of, and whether there exists a 
law enforcement or security risk in permitting, the foreign national to 
travel to the United States under the program. DHS recommends that 
applicants obtain ESTA authorizations at the time of reservation or ticket 
purchase, or at least 72 hours before their planned date of departure for 
the United States. The ESTA application will electronically collect 
information similar to the information collected in paper form by CBP. 11 
To the extent possible, according to DHS, applicants will find out almost 
immediately whether their travel has been authorized, in which case they 
are free to travel to the United States, or if their application has been 
rejected, in which case they are ineligible to travel to the United States 
under the Visa Waiver Program. 12 Those found ineligible to travel under the 



'"Section 711 of the 9/11 Act specifically grants DHS the authority to waive the 3 percent 
refusal rate requirement for countries — currently up to a maximum of 10 percent — 
provided those countries meet other security requirements. 

"This form is CBP's I-94W Nonimmigrant Visa Waiver Arrival/Departure Form. According 
to DHS, the department is coordinating with commercial aircraft and vessel carriers on the 
development and implementation of messaging capabilities that will enable CBP to provide 
the carriers with messages pertaining to a passenger's boarding status. Once ESTA is 
mandatory and all carriers are capable of receiving and validating messages from CBP 
pertaining to the traveler's ESTA status as part of their boarding status, DHS plans to 
eliminate the I-94W requirement. 

12 ESTA authorizations will be valid for up to 2 years and will allow the individual to travel 
to the United States repeatedly within that period. In some circumstances, such as when a 
passport has expired or a traveler has changed his or her name, the traveler must apply for 
a new ESTA authorization. 
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Visa Waiver Program must apply for a visa at a U.S. embassy to travel to 
the United States. 13 



In addition, the 9/11 Act requires that visa waiver countries 

• enter into an agreement with the United States to report, or make available 
through Interpol or other means as designated by the Secretary of 
Homeland Security, to the U.S. government information about the theft or 
loss of passports within a strict time frame; 

• enter into an agreement with the United States to share information 
regarding whether citizens and nationals of that country traveling to the 
United States represent a threat to U.S. security; and 

• accept for repatriation any citizen, former citizen, or national of the 
country against whom the United States has issued a final order of 
removal. 



When DHS exercises its authority to waive the 3 percent refusal rate 
requirement, it shall, in consultation with State, take into account other 
discretionary factors, pursuant to the 9/11 Act, including a country's 
airport security standards; whether the country assists in the operation of 
an effective air marshal program; the standards of passports and travel 
documents issued by the country; and other security-related factors, 
including the country's cooperation with (1) the United States' initiatives 
toward combating terrorism and (2) the U.S. intelligence community in 
sharing information regarding terrorist threats. DHS works in consultation 
with State and Justice, as well as the intelligence community, as part of 
DHS's assessment of countries seeking to join the Visa Waiver Program. 



13 In addition to receiving an authorization or rejection notice upon submitting an ESTA 
application, the applicant may also receive a response noting that the application is 
pending. 
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Executive Branch Is 
Moving Quickly to 
Expand the Visa 
Waiver Program 
without a Transparent 
Process 



The executive branch is moving aggressively to expand the Visa Waiver 
Program by the end of 2008, but, in doing so, DHS has not followed a 
transparent process for admitting new countries to the program — an 
approach that has created confusion among other U.S. agencies in 
Washington, D.C.; U.S. embassy officials overseas; and those countries 
that are seeking to join the Visa Waiver Program. During the expansion 
negotiations, DHS has achieved some security enhancements, such as new 
agreements that, among other things, require the reporting of lost and 
stolen blank and issued passports. 



DHS Has Not Followed a 
Transparent Process for 
Visa Waiver Program 
Expansion 



We found that the Visa Waiver Program Office has not followed its own 
standard operating procedures, completed in November 2007, which set 
forth the key milestones that DHS and aspiring countries must meet before 
additional countries are admitted into the program. 14 According to the 
standard procedures, State should submit to DHS a formal, written 
nomination for a particular country, after which DHS is to lead an 
interagency team to conduct an in-country, comprehensive review of the 
impact of the country's admission into the Visa Waiver Program on U.S. 
security, law enforcement, and immigration interests. Figure 1 depicts the 
standard procedures that the program office established to guide 
expansion of the Visa Waiver Program compared with DHS's actions since 
August 2007. Although State has only nominated one country — Greece — 
DHS has nonetheless conducted security reviews for countries that State 
has not yet nominated — Czech Republic, Estonia, Hungary, Latvia, 
Lithuania, Slovakia, and South Korea. According to State officials, until 
DHS has implemented the required provisions of the 9/11 Act, and aspiring 
countries have met all of the Visa Waiver Program's statutory 
requirements, State does not plan to nominate any other countries. DHS's 
Assistant Secretary for Policy Development told us that the department 
had determined that it would not follow the standard operating 
procedures during these expansion negotiations and, thus, had to "make 
up the process as it went along," in part because DHS had never expanded 
the program before and because Congress significantly changed the 
program's legislative requirements in August 2007. 



"In 2006, we reported on the executive branch's process for admitting additional countries 
into the Visa Waiver Program. See GAO, Process for Admitting Additional Countries into 
the Visa Waiver Program, GAO-06-835R (Washington, D.C.: July 26, 2006). 
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Figure 1 : Comparison of DHS's Process to Expand the Visa Waiver Program against the Standard Operating Procedures for 
Expansion 
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State and Justice officials told us that the lack of a transparent timeline 
and requirements for Visa Waiver Program expansion has led to confusion 
among U.S. agencies in headquarters' offices and at U.S. embassies 
overseas, as well as foreign governments seeking to join the program. For 
example, DHS's standard procedures were not updated to account for the 
department's plans to sign with each of the aspiring Visa Waiver Program 
countries separate memorandums of understanding (MOU) that lay out the 
new legislative requirements from the 9/11 Act. According to DHS, while 
not required by the act, the U.S. government is seeking to negotiate MOUs 
with current and aspiring Visa Waiver Program countries to help put the 
legislative provisions in place. Although DHS has not yet signed MOUs 
with any current program countries, the department intends to complete 
negotiations with existing program countries by October 2009. As 
indicated in figure 1, DHS signed MOUs with aspiring countries before 
conducting in-country security reviews. The MOUs are to be accompanied 
by more specific "implementing arrangements" for sharing biographic, 
biometric, and other data, as required by the 9/11 Act, within general 
parameters of what the United States is willing and able to reciprocate — 
this includes sharing information on known or suspected terrorists. 
According to DHS, the type and scope of these arrangements will vary by 
country and will take into account existing bilateral information-sharing 
arrangements. As of June 2008, DHS had signed MOUs with eight Road 
Map countries and had begun negotiations on the implementing 
arrangements. However, State and Justice officials told us that DHS had 
not been clear in communicating these steps to aspiring and current 
program countries. DHS officials acknowledged that the department was 
still exploring how to best complete the implementing arrangements. U.S. 
embassy officials in several Road Map countries told us that it had been 
difficult to explain the expansion process to their foreign counterparts and 
manage their expectations about when those countries might be admitted 
into the Visa Waiver Program. Justice officials and U.S. officials in several 
embassies told us that the implementing arrangements may be more 
difficult to negotiate than the nonbinding MOUs because some countries 
have expressed concerns about sharing private information on their 
citizens due to strict national privacy laws — concerns that the United 
States also has about its citizens' information. In response to our request, 
in late April 2008, DHS provided us with an outline of the department's 
completed and remaining actions for expanding the Visa Waiver Program 
by the end of this year. DHS officials stated that this outline could be a 
first step in providing guidance for all stakeholders, should the program be 
expanded again in the future. However, the outline does not include 
criteria for selecting countries under consideration for admission into the 
program, other than the 13 Road Map countries. 
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The U.S. government is only considering the Road Map countries for 
potential admission into the program in 2008 because the United States 
began formal discussions with these 13 countries several years ago, not 
due to the application of clearly defined requirements. DHS is negotiating 
with 4 Road Map countries with fiscal year 2007 refusal rates over 10 
percent (Hungary, Latvia, Lithuania, and Slovakia), with the expectation 
that fiscal year 2008 refusal rates for these countries will fall below 10 
percent. State officials told us that they lacked a clear rationale to explain 
to other aspiring, non-Road Map countries with refusal rates under 10 
percent (Croatia, Israel, and Taiwan) that they will not be considered in 
2008 due to the executive branch's plans to expand the program first to 
South Korea and countries in Central and Eastern Europe. In addition, on 
May 1 of each year, State must report to Congress those countries that are 
under consideration for inclusion in the Visa Waiver Program; the 
department has never submitted this report because, according to 
consular officials, no country has been under consideration for admission 
into the program since the reporting requirement was established in 2000. lD 
As of late June 2008, State had not yet submitted its report for 2008. A 
State official told us that, despite the actions that DHS, State, and other 
U.S. agencies have taken to expand the Visa Waiver Program to as many as 
9 countries in 2008, State was initially unclear about which countries it 
should include in this report. While only Greece has been nominated, DHS 
has made clear its goal to admit many of the Road Map countries in 2008. 
(Fig. 2 shows the fiscal year 2007 refusal rates for the 13 Road Map 
countries.) 



' 'State must report to the appropriate congressional committees on the total number of 
nationals of that country who applied for U.S. visas in that country during the previous 
calendar year; the total number of such nationals who received U.S. visas during the 
previous calendar year; the total number of such nationals who were refused U.S. visas 
during the previous calendar year, and, specifically, under which provision of the 
Immigration and Nationality Act they were refused; and the number of such nationals who 
were refused visas under section 214(b)of the Immigration and Nationality Act as a 
percentage of the visas that were issued to such nationals. In addition, not later than May 1 
of each year, the U.S. chief of mission (acting or permanent) to each country under 
consideration for inclusion in the Visa Waiver Program, must certify to the appropriate 
congressional committees that the information described in the report is accurate, and 
must provide a copy of the certification to the congressional committees. 
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Figure 2: Short-term Business and Tourism Visa Refusal Rates, by Country, Fiscal Year 2007 
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According to DHS, it could not wait until all statutory requirements were 
officially met before beginning bilateral negotiations with Road Map 
countries, because doing so would not allow sufficient time to add the 
countries by the end of 2008. DHS plans to complete the security reviews 
and sign MOUs and implementing arrangements with Road Map countries 
by the fall of 2008. If these and all other statutory provisions are 
completed — including countries' achievement of refusal rates below 10 
percent — State indicated that it will then formally nominate the countries. 
However, DHS has acknowledged that if it and the aspiring countries 
cannot meet all of the program's statutory requirements, the United States 
will not admit additional countries into the program. In such an event, the 
U.S. government could face political and diplomatic repercussions, given 
the expectations raised that many of the Road Map countries will be 
admitted in 2008. DHS, State, and Justice officials acknowledged that 
following a more transparent process would be useful in the future as 
additional countries seek to join the program. 



DHS Has Achieved Some 
Results in Visa Waiver 
Program Expansion 
Negotiations 



DHS's expansion negotiations with current and aspiring Visa Waiver 
Program countries have led to commitments from countries to improve 
information sharing processes with the United States. For example, by 
signing MOUs, eight aspiring countries have signaled their intent to 
comply with the program's statutory provision to report to the United 
States or Interpol in a timely manner the loss or theft of passports — a key 
vulnerability in the Visa Waiver Program, as we have previously reported. 16 
In addition, as a result of ongoing visa waiver negotiations with the South 
Korean government, in January 2008, DHS initiated the Immigration 
Advisory Program at Incheon International Airport in South Korea to help 
prevent terrorists and other high-risk travelers from boarding commercial 
aircraft bound for the United States. 1 ' Furthermore, a senior consular 
official testified that the executive branch's dialogue on Visa Waiver 



I6 GAO-06-854. 

"According to CBP, the Immigration Advisory Program aims to enhance the safety of air 
travel by, among other things, reducing the number of improperly documented passengers 
traveling from or through a country to the United States. As of August 2008, the program 
operates in airports in Amsterdam, the Netherlands; Frankfurt, Germany; London, England 
(Heathrow Airport and Gatwick Airport); Manchester, England; Madrid, Spain; Seoul, 
South Korea; Tokyo, Japan; and Warsaw, Poland. 
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Program expansion is helping to stimulate U.S. negotiations on other 
terrorist watch-list- sharing arrangements with Road Map countries. 18 



DHS Has Not Fully 
Developed Tools 
Aimed at Assessing 
and Mitigating Risks 
in the Visa Waiver 
Program 



As of early September 2008, DHS had not yet met two key certification 
requirements in the 9/11 Act that are necessary to allow the department to 
consider expanding the Visa Waiver Program to countries with refusal 
rates between 3 percent and 10 percent. In addition, the Visa Waiver 
Program Office does not fully consider data on overstay rates for current 
and aspiring Visa Waiver Program countries, even though doing so is 
integral to meeting a statutory requirement for continued eligibility in the 
Visa Waiver Program. Finally, in reviewing recommendations from our 
2006 report aimed at improving efforts to assess and mitigate program 
risks, we found that DHS has implemented many of our prior 
recommendations, but some are only partially implemented. 



DHS Has Not yet 
Implemented Key Security 
Provisions of 9/11 Act That 
Are Necessary to Admit 
Certain Countries into the 
Visa Waiver Program 



On February 28, 2008, we testified that DHS's plan for certifying that it can 
verify the departure of 97 percent of foreign nationals from U.S. airports 
will not help the department mitigate risks of the Visa Waiver Program. 19 
Furthermore, DHS will face a number of challenges in implementing ESTA 
by January 2009. Finally, it is unlikely that DHS will implement a biometric 
air exit system before July 2009, due to opposition from the airline 
industry. 



Plan to Verify the Air Departure 
of Foreign Nationals Will Not 
Help DHS Mitigate Program 
Risks 



As we have previously mentioned, the 9/11 Act requires that DHS certify 
that a system is in place that can verify the departure of not less than 97 
percent of foreign nationals who depart through U.S. airports. In 
December 2007, DHS reported to us that it will match records, reported by 



18 Homeland Security Presidential Directive-6 required the Secretary of State to develop a 
proposal for the President's approval for enhancing cooperation with certain foreign 
governments — beginning with those countries for which the United States has waived visa 
requirements — to establish appropriate access to the participating governments' terrorism 
screening information. State determined that the most effective way to obtain this 
information was to seek bilateral agreements to share information on a reciprocal basis. In 
May 2008, the Deputy Assistant Secretary of State for Visa Services testified that State 
anticipates completing these agreements with all of the Road Map countries by the end of 
September 2008. See, The White House, Homeland Security Presidential Directive/HSPD- 
6, Subject: Integration and Use of Screening Information (Washington, D.C.: Sept. 16, 
2003). 

10 GAO, Visa Waiver Program: Limitations with Department of Homeland Security's Plan 
to Verify Departure of Foreign Nationals, GAO-08-458T (Washington, D.C.: Feb. 28, 2008). 
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airlines, of visitors departing the country to the department's existing 
records of any prior arrivals, immigration status changes, 21 or prior 
departures from the United States. At the time of our February 2008 
testimony, DHS had confirmed that it planned to employ a methodology 
that begins with departure records. During the hearing, we also testified 
that this methodology will not demonstrate improvements in the air exit 
system and will not help the department mitigate risks of the Visa Waiver 
Program. We identified a number of weaknesses with this approach, as 
follows: 

• First, DHS's methodology will not inform overall or country-specific 
overstay rates, which are key factors in determining illegal immigration 
risks in the Visa Waiver Program. In particular, DHS's methodology does 
not begin with arrival records to determine if those foreign nationals 
departed or remained in the United States beyond their authorized periods 
of admission — useful data for oversight of the Visa Waiver Program and its 
expansion. As we previously testified, an alternate approach would be to 
track air arrivals from a given point in time and determine whether those 
foreign nationals have potentially overstayed. 22 Figure 3 compares DHS's 
plan to match visitor records using departure data as a starting point with 
a methodology that would use arrival data as a starting point. 



20 Air carriers transmit visitor manifest information, which is obtained directly from 
government-issued passports, to CBP through the Advanced Passenger Information 
System. This system includes arrival and departure manifest information, such as name, 
date of birth, travel document issuing country, gender, U.S. destination address, entry date, 
and departure date. As of February 19, 2008, commercial carriers are required to transmit 
manifest information to be vetted by DHS prior to departure of the aircraft. 

21 This includes changes and extensions of the visits of lawfully admitted, nonimmigrant 
foreign nationals. 

22 This could include foreign nationals who departed after their authorized period of 
admission expired, as well as those foreign nationals who may have remained in the 
country as overstays. 
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Figure 3: DHS's Current Plan to Meet Air Exit System Provision Omits Those Who 
Remain in the United States 
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Second, for purposes of this provision and Visa Waiver Program 
expansion, we do not see the value in verifying that a foreign national 
leaving the United States had also departed at a prior point in time 23 — in 
other words, matching a new departure record back to a previous 



23 According to ICE officials at DHS, this type of information provides a more complete 
history of an alien and is useful for law enforcement purposes, such as criminal 
prosecution and documenting activities. 



Page 17 



GAO-08-967 Visa Waiver Program 



departure record from the country. 24 DHS's Assistant Secretary for Policy 
Development told us in January 2008 that the department chose to include 
previous departures and changes of immigration status records because 
this method allowed the department to achieve a match rate of 97 percent 
or greater. 

• Third, DHS's methodology does not address the accuracy of airlines' 
transmissions of departure records, and DHS acknowledges that there are 
weaknesses in the departure data. Foreign nationals who enter the United 
States by air are inspected by DHS officers — a process that provides 
information that can be used to verify arrival manifest data — and, since 
2004, DHS has implemented the US-VISIT program to collect biometric 
information on foreign nationals arriving in the United States. 25 However, 
the department has not completed the exit portion of this tracking system; 
thus, there is no corresponding check on the accuracy and completeness 
of the departure manifest information supplied by the airlines. 26 According 
to DHS, it works with air carriers to try to improve both the timeliness and 
comprehensiveness of manifest records, and fines carriers that provide 
incomplete or inaccurate information. If DHS could evaluate these data, 
and validate the extent to which they are accurate and complete, the 
department would be able to identify problems and work with the airlines 
to further improve the data. 

An air exit system that facilitates the development of overstay rate data is 
important to managing potential risks in expanding the Visa Waiver 



24 A DHS official told us that the system functions by matching the departure record with an 
alien's "account," which may contain numerous prior arrivals, departures, and immigration 
benefit transaction records. The official also stated that a specific departure record match 
may not fall chronologically in the alien's account after an arrival; it may fall, for example, 
after a record that an immigrant benefit was granted to extend the alien's stay for an 
additional 6 months. 

23 DHS's US-VISIT program collects, maintains, and shares data, including biometric 
identifiers like digital fingerprints, on selected foreign nationals entering the United States 
to verify their identities as they arrive at U.S. air, sea, and land ports of entry. DHS 
currently operates the entry portion of the US-VISIT program at more than 300 U.S. air, sea, 
and land ports of entry. When fully implemented, US- VISIT is also intended to capture the 
same information from foreign nationals as they depart the country. The program aims to, 
among other things, identify foreign nationals who have overstayed or violated the terms of 
their visit. 

26 DHS has not implemented long-standing GAO recommendations to collect departure 
information and make new estimates of overstays by air. See GAO, Illegal Immigration: 
INS Overstay Estimation Methods Need Improvement, GAO/PEMD-95-20 (Washington, 
D.C.: Sept. 26, 1995); and Illegal Aliens: Despite Data Limitations, Current Methods 
Provide Better Population Estimates, GAO/PEMD-93-25 (Washington, D.C.: Aug. 3, 1993). 
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Program. We found that DHS's planned methodology for meeting the "97 
percent provision" so it can move forward with program expansion will 
not demonstrate improvements in the air exit system or help the 
department identify overstays or develop overstay rates. As of early 
September 2008, DHS had not yet certified this provision, nor had it 
finalized a methodology to meet the provision. 

DHS's Planned Implementation m June 2008, DHS announced in the Federal Register that it anticipates 
of ESTA by January 2009 Will that all visa waiver travelers will be required to obtain ESTA authorization 
Face Challenges f° r vi sa waiver travel to the United States after January 12, 2009. However, 

we identified four potential challenges that DHS may face in implementing 
ESTA, including a limited time frame to adequately inform U.S. embassies 
and the public and the significant impact that ESTA will have on the airline 
and travel industry. 

We have previously reported that visa waiver travelers pose inherent 
security and illegal immigration risks to the United States, since they 
(1) are not subject to the same degree of screening as travelers with visas 
and (2) are not interviewed by a consular officer before arriving at a U.S. 
port of entry. 27 In the 9/11 Act conference report, 28 Congress agreed on the 
need for significant security enhancements to the Visa Waiver Program 
and to the implementation of ESTA prior to permitting DHS to admit new 
countries into the program with refusal rates between 3 percent and 10 
percent. According to DHS, ESTA will allow DHS to identify potential 
ineligible visa waiver travelers before they embark on a U.S.-bound carrier. 
DHS also stated that by recommending that travelers submit ESTA 
applications 72 hours in advance of their departure, CBP will have 
additional time to screen visa waiver travelers destined for the United 
States. 

DHS must follow several steps in implementing ESTA (see fig. 4). First, the 
9/11 Act requires that DHS must certify both the 97 percent air exit system 
and ESTA as fully operational before the department can consider 
expanding the Visa Waiver Program to countries with refusal rates 
between 3 percent and 10 percent. DHS has not announced when it plans 
to make this certification. DHS attorneys told us that the department could 
admit additional countries to the program once it provides this 



27 GAO-06-854. 

2S Conference Report on H.R. 1, Implementing Recommendations of the 9/11 Commission 
Act of 2007 (July 25, 2007). 
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certification. In addition, according to DHS, the act provides that 60 days 
after the Secretary of Homeland Security publishes a final notice in the 
Federal Register of the ESTA requirement, each alien traveling under the 
Visa Waiver Program must use ESTA to electronically provide DHS with 
biographic and other such information as DHS deems necessary to 
determine, in advance of travel, the eligibility of, and whether there exists 
a law enforcement or security risk in permitting, the alien to travel to the 
United States. 29 DHS stated that it expects to issue this final notice in early 
November 2008, and, as of January 12, 2009, all visa waiver travelers would 
be required to obtain authorization through ESTA prior to boarding a U.S.- 
bound flight or cruise vessel. DHS stated that if, after certifying ESTA as 
fully operational, it admits an additional country prior to January 12, 2009, 
it will require that visa waiver travelers from that country obtain ESTA 
authorizations immediately. For example, if Estonia were admitted into 
the Visa Waiver Program on October 10, 2008, citizens of that country 
traveling to the United States under the program would be required to 
begin using ESTA on that date; however, visa waiver travelers from 
existing program countries would not be required to obtain approval 
through ESTA until January 12, 2009, more than 3 months later. 



29 DHS attorneys stated that the department also hopes to certify ESTA as fully operational 
in early November. In addition, as we have previously mentioned, to consider admitting 
countries into the program with refusal rates between 3 percent and 10 percent, DHS must 
also certify that the air exit system is in place. 



Page 20 



GAO-08-967 Visa Waiver Program 



Figure 4: DHS's Anticipated ESTA Implementation Timeline 
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We identified four potential challenges to DHS's planned implementation 
of ESTA by January 12, 2009. It is difficult to predict the extent to which 
DHS will address these challenges due to the short time frame in which 
the department is implementing the system. These challenges include the 
following: 

• DHS has a limited timeframe to adequately inform U.S. embassies in 
Visa Waiver Program countries and the public about ESTA. U.S. embassy 
officials in current and aspiring Visa Waiver Program countries told us that 
the United States will need to ensure that there is sufficient time to inform 
travelers, airlines, and the travel industry of ESTA requirements and 
implementation timelines. U.S. commercial and consular officials at a U.S. 
embassy in a current Visa Waiver Program country told us that they would 
ideally like 1 year's advance notice before ESTA is implemented to allow 
sufficient time to inform and train the public and the travel industry of the 
new requirement. However, DHS's announcement in June 2008 accelerated 
the timeline for ESTA implementation in current visa waiver countries. 
During our site visits in March 2008, U.S. embassy officials in a visa waiver 
country told us that they had been informed by DHS officials that the 
department did not plan to require ESTA authorization for travelers from 
that country until the summer of 2009 or later. According to a senior U.S. 
official at one embassy, DHS had confirmed this plan with host country 
government officials in early May 2008. Following the June 2008 
announcement, a senior U.S. embassy official in another country told us 
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that DHS did not give the embassy adequate advance notice — to prepare 
translated materials, brief journalists from the major media, prepare the 
embassy Web site, or set up a meeting with travel and tourism 
professionals to discuss the implications of ESTA requirements — before 
publishing the interim final rule. DHS officials told us that the department 
is currently working on an outreach strategy to ensure that travelers are 
aware of the ESTA requirement. 

• Impact on air and sea earners could be significant. DHS estimates that 8 
U.S.-based air carriers and 11 sea carriers, as well as 35 foreign-based air 
carriers and 5 sea carriers, will be affected by ESTA requirements for visa 
waiver travelers. In addition, DHS stated that it did not know how many 
passengers annually would request that their carrier apply for ESTA 
authorization on their behalf to travel under the Visa Waiver Program or 
how much it will cost carriers to modify their existing systems to 
accommodate such requests. Thus, in the short term, DHS expects that the 
carriers could face a notable burden if most of their non-U.S. passengers 
request that their carriers submit ESTA applications. On the basis of DHS's 
analysis, ESTA could cost the carriers about $137 million to $1.1 billion 
over the next 10 years, depending on how the carriers decide to assist the 
passengers. DHS has noted that these costs to carriers are not compulsory 
because the carriers are not required to apply for an ESTA authorization 
on behalf of their visa waiver travelers. DHS is developing a separate 
system, independent from ESTA, which will enable the travel industry to 
voluntarily submit an ESTA application on behalf of a potential Visa 
Waiver Program traveler. As of early August 2008, DHS had analyzed the 
role that transportation carriers could play in applying for and submitting 
ESTA applications on behalf of their customers when they arrive at an air 
or sea port. However, CBP stated that there had been no further 
development on this issue. 

• ESTA could increase consular workload. In May 2008, we reported that 
State officials and officials at U.S. embassies in current Visa Waiver 
Program countries are concerned with how ESTA implementation will 
affect consular workload. 30 Consular officers are concerned that more 
travelers will apply for visas at consular posts if their ESTA applications 
are rejected or because they may choose to apply for a visa that has a 
longer validity period (10 years) than an ESTA authorization. We reported 
that if 1 percent to 3 percent of current Visa Waiver Program travelers 



30 GAO, Border Security: State Department Should Plan for Potentially Significant 
Staffing and Facilities Shortfalls Caused by Changes in the Visa Waiver Program, 
GAO-08-623 (Washington, D.C.: May 22, 2008). 
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came to U.S. embassies for visas, it could greatly increase visa demand at 
some locations, which could significantly disrupt visa operations and 
possibly overwhelm current staffing and facilities. 31 DHS officials told us 
that the department is aware of concerns regarding rejection rates and has 
been working with State to create a system that mitigates these concerns. 

• Developing a user-friendly ESTA could be difficult. According to DHS, 
the ESTA Web site will initially be operational in English; additional 
languages will be available by October 15, 2008. Even when the Web site is 
operational in additional languages, ESTA will only allow travelers to fill 
out the application in English, as with CBP's paper-based form. In 
addition, during our site visits, embassy officials expressed concerns that 
some Visa Waiver Program travelers do not have Internet access and, thus, 
will face difficulties in submitting their information to ESTA. 32 
Implementing a user-friendly ESTA is essential, especially for those 
travelers who do not have Internet access or are not familiar with 
submitting forms online. 

Implementation of Biometric A third provision of the 9/11 Act requires that DHS implement a biometric 
Air Exit System before July air exit system before July 1, 2009, or else the department's authority to 

2009 Will Be Difficult waive the 3 percent refusal rate requirement — and thereby consider 

admitting countries with refusal rates between 3 percent and 10 percent — 
will be suspended until this system is in place. In March 2008, DHS 
testified that US-VISIT will begin deploying biometric exit procedures in 
fiscal year 2009. DHS released a proposed rule for the biometric exit 
system in April 2008, and the department plans to issue a final rule before 
the end of 2008. According to the proposed rule, air and sea carriers are to 
collect, store, and transmit to DHS travelers' biometrics. During the public 
comment period on the proposed rule, airlines, Members of Congress, and 
other stakeholders have raised concerns about DHS's proposal, and 
resolving these concerns could take considerable time. For example, the 
airline industry strongly opposes DHS's plans to require airline personnel 
to collect digital fingerprints of travelers departing the United States 



31 As of May 2008, DHS had provided State with preliminary data that suggest how many 
names might be rejected by ESTA, on the basis of rejection rates from CBP's Advance 
Passenger Information System; however, we found that DHS had not developed any 
estimates of the number of people who would choose to proactively apply for visas rather 
than submit an application to ESTA. According to consular officials, the percentage of 
travelers who choose to obtain a visa could exceed potential ESTA rejection rates of 1 
percent to 3 percent. See GAO-08-623. 

32 According to DHS, ESTA is designed to allow third parties to file applications on behalf of 
other persons. 
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because it believes it is a public sector function. We have issued a series of 
reports on the US- VISIT program indicating that there is no clear schedule 
for implementation of the exit portion of the system, and that DHS will 
encounter difficulties in implementing the system by July 2009. 33 Although 
DHS program officials stated that DHS is on track to implement the 
biometric exit system by July 2009, it is unlikely that DHS will meet this 
timeline. We are currently reviewing DHS's proposed rule and plan to 
report later this year on our findings. 



Some DHS components have expanded efforts to identify citizens who 
enter the United States under the Visa Waiver Program and then overstay 
their authorized period of admission. In 2004, US- VISIT established the 
Data Integrity Group, which develops data on potential overstays by 
comparing foreign nationals' arrival records with departure records from 
U.S. airports and sea ports. US- VISIT provides data on potential overstays 
to ICE, CBP, and U.S. Citizenship and Immigration Services, as well as to 
State's consular officers to aid in visa adjudication. For example, US- VISIT 
sends regular reports to ICE's Compliance Enforcement Unit on potential 
overstays, and ICE officials told us they use these data regularly during 
investigations. In fiscal year 2007, ICE's Compliance Enforcement Unit 
received more than 12,300 overstay leads from the Data Integrity Group. 34 
As an example of one of these leads, on November 27, 2007, ICE agents in 
Ventura, California, arrested and processed for removal from the United 
States an Irish citizen whose term of admission expired in September 2006. 
On the basis of concerns that Visa Waiver Program travelers could be 
overstaying, ICE has requested that US-VISIT place additional emphasis on 
identifying potential overstays from program countries. In turn, ICE has 
received funding to establish a Visa Waiver Enforcement Program within 
the Compliance Enforcement Unit to investigate the additional leads from 
US- VISIT. As part of this funding, ICE plans to hire 46 additional 
employees to help the unit increase its focus on identifying individuals 



:33 GAO, Homeland Security: Prospects For Biometric US-VISIT Exit Capability Remain 
Unclear, GAO-07-1044T (Washington, D.C.: June 28, 2007); Border Security: US-VISIT 
Program Faces Strategic, Operational, and Technological Challenges at Land Ports of 
Entry, GAO-07-248 (Washington, D.C.: Dec. 6, 2006). 

34 In June 2003, ICE's Office of Investigations established the Compliance Enforcement Unit, 
which focuses on preventing criminals and terrorists from exploiting the nation's 
immigration system by developing cases for investigation on the basis of information 
provided from other DHS components, including US-VISIT. 
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who traveled to the United States under the Visa Waiver Program and 
potentially overstayed. 

However, DHS is not fully monitoring compliance with a legislative 
provision that requires a disqualification rate (this calculation includes 
overstays) of less than 3.5 percent for a country to participate in the Visa 
Waiver Program. 3D Monitoring these data is a long-standing statutory 
requirement for the program. We have testified that the inability of the U.S. 
government to track the status of visitors in the country, identify those 
who overstay their authorized period of visit, and use these data to 
compute overstay rates has been a long-standing weakness in the 
oversight of the Visa Waiver Program. 36 DHS's Visa Waiver Program Office 
reported that it does not monitor country overstay rates as part of its 
mandated, biennial assessment process for current visa waiver countries 
because of weaknesses in US- VISIT'S data. 37 

Since 2004, however, the Data Integrity Group has worked to improve the 
accuracy of US- VISIT'S overstay data and can undertake additional 
analyses to further validate these data. For example, using available 
resources, the group conducts analyses, by hand, of computer-generated 
overstay records to determine whether individuals identified as overstays 
by the computer matches are indeed overstays. In addition, US- VISIT 
analysts can search up to 12 additional law enforcement and immigration 
databases to verify whether a potential overstay may, in fact, be in the 
country illegally. While it receives periodic reporting on potential 



35 The disqualification rate is the total for a given fiscal year of (1) those nationals of the 
country who were admitted as nonimmigrants and violated the terms of their admission — 
this would include overstays — and (2) the number of foreign nationals who were denied 
admission upon arrival in the United States, compared with the total number of nationals of 
that country who applied for admission as nonimmigrant visitors during the same period. 
According to the visa waiver statute, the country must be terminated at the beginning of 
the 2d fiscal year following the fiscal year in which the determination of the disqualification 
rate was made. See 8 U.S.C. § 1187(f). 

36 For more than 10 years, we have recommended the collection of departure information 
and the development of estimates of overstays by air. See GAO/PEMD-93-25 and 
GAO/PEMD-95-20. 

"According to DHS officials, the mandated country assessments include a placeholder for 
data on overstay rates, but these data are not included in the 2003-2004 or 2005-2006 
assessments. The May 2002 Enhanced Border Security and Visa Entry Reform Act 
increased the frequency — from once every 5 years to once every 2 years — of mandated 
assessments of the effect of each country's continued participation in the Visa Waiver 
Program on U.S. security, law enforcement, and immigration interests. See 
Pub. L. No. 107-173. 
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overstays from US-VISIT, the Visa Waiver Program Office has not 
requested that the Data Integrity Group provide validated overstay rate 
estimates from visa waiver or Road Map countries since 2005. Although 
DHS has not designated an office with the responsibility of developing 
such data for the purposes of the Visa Waiver Program, US- VISIT officials 
told us that, with the appropriate resources, they could provide more 
reliable overstay data and estimated rates, by country, to the Visa Waiver 
Program Office, with support from other DHS components, such as the 
Office of Immigration Statistics. For example, the Visa Waiver Program 
Office could request additional analysis for countries where the 
preliminary, computer-generated overstay rates raised concerns about 
illegal immigration risks in the program. These resulting estimates would 
be substantially more accurate than the computer-generated overstay 
rates. However, the resulting estimates would not include data on 
departures at land ports of entry. In addition, as we have previously 
mentioned, airline departure data have weaknesses. 38 DHS has asserted 
that overstay data will continue to improve with the implementation of the 
biometric US- VISIT exit program. 

In addition to US- VISIT, State's overseas consular sections develop data on 
overstay rates that might be useful for assessing potential illegal 
immigration risks of the Visa Waiver Program. Specifically, some consular 
sections have conducted validation studies to determine what percentage 
of visa holders travel to the United States and potentially overstay. For 
example, at the U.S. embassy in Estonia, consular officials conducted a 
validation study in the summer of 2006 that concluded that 2.0 percent to 
2.7 percent of Estonian visa holders traveling to the United States in 2005 
had potentially overstayed. 39 US-VISIT overstay data, after appropriate 
analysis and in conjunction with other available data, such as validation 
studies, would provide DHS with key information to help evaluate the 



38 Due to limitations in DHS's data, U.S. VISIT officials also noted that some individuals who 
appear in DHS's systems as being in-country legally may actually be overstays, and that 
country-specific information is not available for about 2 percent of records. 

'"Validation studies are traditionally conducted over the telephone, with the embassy 
contacting nationals who traveled to the United States. According to a State consular 
official, 200 posts have access to DHS's Automated Departure Information System 
database. This database contains records of foreign nationals' arrival and departure data 
received from air and sea carrier manifests. DHS's data will assist embassies in conducting 
validation studies and may preclude the need for telephone calls to foreign nationals, while 
also improving the accuracy of departure data assessed for these studies. Access to these 
records will allow consular posts to more accurately determine whether a foreign national 
departed the United States. 
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illegal immigration risks of maintaining a country's membership or 
admitting additional countries into the Visa Waiver Program. 



DHS Has Implemented 
Many of GAO's Prior 
Recommendations Aimed 
at Improving Efforts to 
Assess and Mitigate Risks 
in the Visa Waiver Program 



In July 2006, we reported that the process for assessing and mitigating 
risks in the Visa Waiver Program had weaknesses, and that DHS was not 
equipped with sufficient resources to effectively monitor the program's 
risks. 40 For example, at the time of our report, DHS had only two full-time 
staff charged with monitoring countries' compliance with the program's 
requirements and working with countries seeking to join the program. We 
identified several problems with the process by which DHS was 
monitoring countries' adherence to the program requirements, including a 
lack of consultation with key interagency stakeholders. In addition, we 
reported that DHS needed to improve its communication with officials at 
U.S. embassies so it could communicate directly with officials best 
positioned to monitor compliance with the program's requirements, and 
report on current events and issues of potential concern in each of the 
participating countries. Also, at the time of our 2006 report, the law 
required the timely reporting of passport thefts for continued participation 
in the Visa Waiver Program, but DHS had not established or 
communicated these time frames and operating procedures to 
participating countries. In addition, DHS had not yet issued guidance on 
what information must be shared, with whom, and within what time frame. 



To address these weaknesses, we recommended that DHS take a number 
of actions to better assess and mitigate risks in the Visa Waiver Program. 
As we note in table 1, DHS has taken actions to implement some of our 
recommendations, but still needs to fully implement others. In particular, 
DHS has provided the Visa Waiver Program Office with additional 
resources since our 2006 report. As of April 2008, the office had five 
additional full-time employees, and two other staff from the Office of 
Policy that devote at least 50 percent of their time to Visa Waiver Program 
tasks. In addition, staff from several other DHS components assists the 
office on a regular basis, as well as during the in-country security 
assessments for Road Map and current program countries. In response to 
our recommendation to finalize clear, consistent, and transparent 
protocols for the biennial country assessment, the Visa Waiver Program 
Office drafted standard operating procedures in November 2007 for 
conducting reviews of nominated and participating visa waiver countries. 



10 GAO-06-854. 
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In addition, DHS now provides relevant stakeholders with copies of the 
most current mandated, biennial country assessments; during our visits in 
early 2008, U.S. embassy officials confirmed that the assessments are now 
accessible. Furthermore, regarding our recommendation to develop and 
communicate clear, standard operating procedures for the reporting of 
lost and stolen blank and issued passports, DHS established criteria for the 
reporting of lost and stolen passport data — including a definition of 
"timely reporting" and an explanation of to whom in the U.S. government 
countries should report — as part of the MOUs it is negotiating with 
participating and Road Map countries. 



Table 1 : Status of Prior GAO Recommendations 



Recommendation 


Not 
implemented 


Partially 
implemented 


Implemented 


Provide additional resources to strengthen the Visa Waiver Program Office. 






X 


Finalize clear, consistent, and transparent protocols for the biennial country 
assessments and provide these protocols to stakeholders at relevant 
agencies at headquarters and overseas. These protocols should provide 
timelines for the entire assessment process, including the role of a site visit, 
an explanation of the clearance process, and deadlines for completion. 






X 


Create real-time monitoring arrangements, including the identification of 
visa-waiver points of contact at U.S. embassies, for all 27 participating 
countries; and establish protocols, in coordination with the appropriate 
headquarters offices, for direct communication between points of contact at 
overseas posts and DHS's Visa Waiver Program Office. 




X 




Require periodic updates from points of contact at posts in countries where 
there are law enforcement or security concerns relevant to the Visa Waiver 
Program. 




X 




Provide complete copies of the most recent country assessments to 
relevant stakeholders in headquarters and overseas posts. 






X 


Require that all Visa Waiver Program countries provide the United States 
and Interpol with nonbiographical data from lost or stolen blank and issued 
passports. 




X 




Develop and communicate clear standard operating procedures for the 
reporting of lost and stolen blank and issued passports, including a 
definition of "timely reporting" and to whom in the U.S. government 
countries should report. 






X 


Develop and implement a plan to make Interpol's stolen travel document 
database automatically available during primary inspection at U.S. ports of 
entry. 






X 



Sources: GAO analysis of DHS data and GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa 
Waiver Program, GAO-06-854 (Washington, D.C.: July 28, 2006). 
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Furthermore, DHS, in coordination with the U.S. National Central Bureau, 
has initiated a system that allows DHS to screen foreign nationals arriving 
at all U.S. international airports against Interpol's database of lost and 
stolen travel documents before the foreign nationals arrive in the country. 
Results to date indicate that the system identifies two to three instances of 
fraudulent passports per month. According to the National Central Bureau, 
Interpol's database has intercepted passports that were not identified by 
DHS's other screening systems. For example, on February 18, 2008, the 
Interpol database identified a Nigerian national traveling on a 
counterfeited British passport who attempted to enter the United States at 
Newark International Airport. Upon arrival, the individual was referred to 
secondary inspection and determined to be inadmissible to the United 
States. 

While DHS has taken action on many of our recommendations, it has not 
fully implemented others. We recommended that DHS require that all Visa 
Waiver Program countries provide the United States and Interpol with 
nonbiographical data from lost or stolen blank and issued passports. 
According to DHS, all current and aspiring visa waiver countries report 
lost and stolen passport information to Interpol, and many report such 
information to the United States. The 9/11 Act requires agreements 
between the United States and Visa Waiver Program countries on the 
reporting of lost and stolen passports within strict time limits; however, 
none of the current visa waiver countries have yet to formally establish 
lost and stolen passport reporting agreements by signing MOUs with DHS. 
DHS also still needs to fully implement our recommendations to create 
real-time monitoring arrangements, establish protocols for direct 
communication with contacts at overseas posts, and require periodic 
updates from these contacts. For example, while the Visa Waiver Program 
Office has recently begun communicating and disseminating relevant 
program information regularly with U.S. embassy points of contact at Visa 
Waiver Program posts, officials at some of the posts we visited in early 
2008 reported that they had little contact with the office and were not 
regularly informed of security concerns or developments surrounding the 
program. 



The executive branch is moving aggressively to expand the Visa Waiver 
Program in 2008 to allies in Central and Eastern Europe and South Korea, 
after the countries have met certain requirements and DHS has completed 
and certified key security requirements in the 9/11 Act. However, DHS has 
not followed a transparent process for expanding the program, thereby 
causing confusion among other U.S. agencies and embassies overseas. The 



Conclusions 
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lack of a clear process could bring about political repercussions if 
countries are not admitted to the program in 2008, as expected. In 
addition, DHS is not fully assessing a critical illegal immigration risk of the 
Visa Waiver Program and its expansion since it does not consider overstay 
data in its security assessments of current and aspiring countries. DHS 
should determine what additional data and refinements of that data are 
necessary to ensure that it can assess and mitigate this potential risk to the 
United States. Finally, DHS still needs to take actions to fully implement 
our prior recommendations in light of plans to expand the program. 



Recommendations for ^° i m P rove management of the Visa Waiver Program and better assess and 

mitigate risks associated with it, we are recommending that the Secretary 
Executive Action of Homeland Security take the following four actions: 

• establish a clear process, in coordination with the Departments of State 
and Justice, for program expansion that would include the criteria used to 
determine which countries will be considered for expansion and timelines 
for nominating countries, security assessments of aspiring countries, and 
negotiation of any bilateral agreements to implement the program's 
legislative requirements; 

• designate an office with responsibility for developing overstay rate 
information for the purposes of monitoring countries' compliance with the 
statutory requirements of the Visa Waiver Program; 

• direct that established office and other appropriate DHS components to 
explore cost-effective actions necessary to further improve, validate, and 
test the reliability of overstay data; and 

• direct the Visa Waiver Program Office to request an updated, validated 
study of estimated overstay rates for current and aspiring Visa Waiver 
Program countries, and determine the extent to which additional research 
and validation of these data are required to help evaluate whether 
particular countries pose a potential illegal immigration risk to the United 
States. 



Agency Comments 
and Our Evaluation 



We provided a draft of this report to DHS, State, and Justice for review and 
comment. DHS provided written comments, which are reproduced in 
appendix IV, and technical comments, which we incorporated into the 
report, as appropriate. Justice also provided written comments, which are 
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reprinted in appendix V. State did not provide comments on the draft 
report. 

DHS either agreed with, or stated that it was taking steps to implement, all 
of our recommendations. For example, DHS indicated that it is working 
with State to create procedures so that future Visa Waiver Program 
candidate countries are selected and designated in as transparent and 
uniform a manner as possible. In addition, DHS noted that it is taking steps 
to improve the accuracy and reliability of the department's overstay data. 
DHS also provided additional details about its continued outreach efforts 
to the department's interagency partners and foreign counterparts on the 
expansion process for the Visa Waiver Program. Justice did not comment 
on our recommendations, but provided additional information about the 
importance of monitoring countries' reporting of lost and stolen passport 
data to Interpol. In addition, Justice discussed its efforts, in collaboration 
with DHS, to include screening against Interpol's lost and stolen passport 
database as part of ESTA. Justice noted that use of Interpol's database 
continues to demonstrate significant results in preventing the misuse of 
passports to fraudulently enter the United States. 



We are sending copies of this report to interested congressional 
committees, the Secretaries of Homeland Security and State, and the U.S. 
Attorney General. Copies of this report will be made available to others 
upon request. In addition, this report is available at no charge on the GAO 
Web site at http://www.gao.gov. 

If you or your staffs have any questions about this report, please contact 
Jess T. Ford, Director, International Affairs and Trade, at (202) 512-4128 or 
fordj@gao.gov. Contact points for our Offices of Congressional Relations 
and Public Affairs may be found on the last page of this report. Key 
contributors to this report are listed in appendix VI. 




Jess T. Ford 

Director, International Affairs and Trade 
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Appendix I: Objectives, Scope, and 
Methodology 



To describe the process that the Department of Homeland Security (DHS) 
is following to admit countries into the Visa Waiver Program, we reviewed 
laws governing the program and its expansion, and relevant regulations 
and agency operating procedures, as well as our prior reports and 
testimonies. In particular, we reviewed DHS's standard operating 
procedures for oversight and expansion of the Visa Waiver Program. We 
spoke with officials from the Visa Waiver Program Office, which is 
responsible for oversight of Visa Waiver Program requirements, as well as 
representatives from the Department of State's (State) Consular Affairs, 
Europe and Eurasia, and East Asia and Pacific Bureaus. In addition, we 
visited U.S. embassies in three current visa waiver countries — France, 
Japan, and the United Kingdom — whose nationals comprise a large 
percentage annually of visa waiver travelers to the United States. We also 
visited U.S. embassies in four countries — Czech Republic, Estonia, Greece, 
and South Korea — with which DHS is negotiating visa waiver status. 
During these visits, we interviewed political, economic, consular, 
commercial, and law enforcement officials regarding oversight of the Visa 
Waiver Program and its expansion. We also conducted telephone 
interviews with consular officials in four additional countries — Hungary, 
Latvia, Lithuania, and Slovakia — that DHS also aims to admit into the Visa 
Waiver Program in 2008. We did not interview officials in Bulgaria, Poland, 
or Romania because DHS told us that it does not anticipate that these 
countries will be admitted into the program in 2008. We did not interview 
officials in Malta because of the country's relatively small number of 
annual Visa Waiver Program travelers to the United States. 

To assess actions taken to mitigate potential risks in the Visa Waiver 
Program, we focused on DHS's efforts to implement the new security 
enhancements required by the 9/11 Act, as well as the recommendations 
from our July 2006 report. 1 First, to review the department's plans for air 
exit system implementation, we collected and analyzed documentation 
and interviewed officials from DHS's Office of Policy, Customs and Border 
Protection (CBP), and the U.S. Visitor and Immigrant Status and Indicator 
Technology (US-VISIT) Program Office. We also reviewed prior GAO 
reports on immigrant and visitor entry and exit tracking systems. 

Second, to analyze plans for the implementation of the Electronic System 
for Travel Authorization (ESTA), we collected and analyzed 



'GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa 
Waiver Program, GAO-06-854 (Washington, D.C.: July 28, 2006). 
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Appendix I: Objectives, Scope, and 
Methodology 



documentation and interviewed officials from DHS's Offices of Policy, 
Screening Coordination, and General Counsel, as well as CBP officials 
who are implementing the Web-based program. In addition, to understand 
DHS's legal position regarding the statutory requirements for ESTA 
implementation, on May 5, 2008, we requested, in writing, DHS's legal 
position on certain ESTA statutory requirements, which the department 
provided to us on June 6, 2008. 

Third, regarding DHS's efforts to monitor citizens who enter the United 
States under the Visa Waiver Program and then overstay their authorized 
period of admission (referred to as "overstays"), we assessed the reliability 
of the US-VISIT data on potential overstays, which are based on air and 
sea carriers' arrival and departure data. We reviewed documentation and 
interviewed cognizant U.S. VISIT officials about how data on potential 
overstays are generated and validated. As we have previously mentioned, 
we determined that data on potential overstays that are generated 
automatically by US-VISIT's systems have major limitations; however, 
many of these limitations could be overcome by a series of manual checks 
and validations that US- VISIT can perform, upon request. 

Fourth, to determine the status of our prior recommendations to DHS on 
oversight of the Visa Waiver Program, we developed a scale to classify 
them as (1) implemented, (2) partially implemented, or (3) not 
implemented. We collected and analyzed documentation and interviewed 
officials from DHS's Visa Waiver Program Office on the actions that office 
has taken since July 2006 to respond to our recommendations. In addition, 
we met with International Criminal Police Organization (Interpol) officials 
in Lyon, France, as well as officials from the Department of Justice's 
Interpol-U.S. National Central Bureau to discuss the status of DHS's access 
to Interpol's database of lost and stolen travel documents. We concluded 
that a recommendation was (1) "implemented," if the evidence indicated 
that DHS had taken a series of actions addressing the recommendation; 
(2) "partially implemented," if the evidence indicated that DHS had taken 
some action toward implementation; and (3) "not implemented," if the 
evidence indicated that DHS had not taken any action. 

We conducted this performance audit from September 2007 to September 
2008 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 
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Appendix II: Worldwide Refusal Rates for 
Short-term Business and Tourism Visas, 
Fiscal Year 2007 



The Visa Waiver Program nonimmigrant visa refusal rate is based on the 
number of visitor visa applications submitted, worldwide, by nationals of 
that country. Visitor visas are issued for short-term business or pleasure 
travel to the United States. The adjusted refusal rate is calculated by first 
subtracting from the number of visas that were initially refused (referred 
to as "refusals"), the number of visas that were subsequently issued after 
further administrative consideration (referred to as "overcomes") — or, in 
short, refusals minus overcomes (see table 2). This resulting number is 
then divided by the number of visa issuances plus refusals minus 
overcomes — that is, refusals minus overcomes divided by issuances plus 
refusals minus overcomes. Adjusted visa refusal rates for nationals of Visa 
Waiver Program countries reflect only visa applications submitted at U.S. 
embassies and consulates abroad. These rates do not take into account 
persons who, under the Visa Waiver Program, travel to the United States 
without visas. Visa Waiver Program country refusal rates, therefore, tend 
to be higher than they would be if the Visa Waiver Program travelers were 
included in the calculation, since such travelers in all likelihood would 
have been issued visas had they applied, according to State. We are 
presenting these data to show that the countries under consideration for 
Visa Waiver Program admission do not all have refusal rates of less than 10 
percent; we did not assess the reliability of these data. 



Table 2: Worldwide Refusal Rates for Short-term Business and Tourism Visas, 


Fiscal Year 2007 




Country 


Adjusted refusal rate 


Afghanistan 


38% 


Albania 


50 


Algeria 


23 


Andorra 


9 


Angola 


13 


Antigua and Barbuda 


15 


Argentina 


4 


Armenia 


61 


Australia 


17 


Austria 


16 


Azerbaijan 


15 


Bahrain 


2 


Bangladesh 


50 


Barbados 


6 


Belarus 


26 
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Short-term Business and Tourism Visas, Fiscal 
Year 2007 



Country 


Adjusted refusal rate 


Belgium 


13 


Belize 


27 


Benin 


37 


Bhutan 


44 


Bolivia 


29 


Bosnia-Herzegovina 


19 


Botswana 


16 


Brazil 


10 


Brunei 


2 


Bulgaria 


14 


Burkina Faso 


43 


Burma 


50 


Burundi 


56 


Cambodia 


53 


Cameroon 


43 


Canada 


37 


Cape Verde 


40 


Central African Republic 


29 


Chad 


29 


Chile 


7 


China - Mainland 


21 


China - Taiwan 


5 


Colombia 


29 


Comoros 


25 


Congo (Brazzaville) 


32 


Congo (Kinshasa) 


35 


Costa Rica 


22 


Cote Dlvoire 


46 


Croatia 


5 


Cuba 


53 


Cyprus 


2 


Czech Republic 


7 


Denmark 


11 


Djibouti 


22 


Dominica 


29 


Dominican Republic 


41 


Ecuador 


28 
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Short-term Business and Tourism Visas, Fiscal 
Year 2007 



Country 


Adjusted refusal rate 


Egypt 


34 


El Salvador 


50 


Equatorial Guinea 


24 


Eritrea 


49 


Estonia 


4 


Ethiopia 


46 


Federated States of Micronesia 





Fiji 


33 


Finland 


16 


France 


8 


Gabon 


23 


Georgia 


55 


Germany 


10 


Ghana 


55 


Great Britain and Northern Ireland 


21 


Greece 


2 


Grenada 


27 


Guatemala 


54 


Guinea 


58 


Guinea - Bissau 


55 


Guyana 


62 


Haiti 


44 


Honduras 


38 


Hong Kong (BNO HK passport) 


2 


Hong Kong S. A. R. 


3 


Hungary 


10 


Iceland 


9 


India 


22 


Indonesia 


40 


Iran 


45 


Iraq 


45 


Ireland 


24 


Israel 


3 


Italy 


7 


Jamaica 


38 


Japan 


12 


Jordan 


39 
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Short-term Business and Tourism Visas, Fiscal 
Year 2007 



Country 


Adjusted refusal rate 


Kazakhstan 


12 


Kenya 


34 


Kiribati 


20 


Kuwait 


4 


Kyrgyzstan 


30 


Laos 


73 


Latvia 


12 


Lebanon 


25 


Lesotho 


40 


Liberia 


51 


Libya 


25 


Liechtenstein 


7 


Lithuania 


13 


Luxembourg 


6 


Macau S.A.R. 


10 


Macedonia 


36 


Madagascar 


14 


Malawi 


37 


Malaysia 


8 


Maldives 


22 


Mali 


56 


Malta 


3 


Mauritania 


59 


Mauritius 


13 


Mexicoa 


33 


Moldova 


36 


Monaco 


38 


Mongolia 


61 


Morocco 


24 


Mozambique 


18 


Namibia 


5 


Nauru 





Nepal 


55 


Netherlands 


12 


New Zealand 


8 


Nicaragua 


46 


Niger 


53 
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Short-term Business and Tourism Visas, Fiscal 
Year 2007 



Country 


Adjusted refusal rate 


Nigeria 


32 


Norway 


9 


Oman 


4 


Pakistan 


40 


Palestinian Authority 


56 


Panama 


26 


Papua New Guinea 


12 


Paraguay 


18 


Peoples Republic of Korea - North Korea 


14 


Peru 


44 


Philippines 


32 


Poland 


25 


Portugal 


8 


Qatar 


2 


Republic of Palau 





Republic of the Marshall Islands 


3 


Romania 


38 


Russia 


12 


Rwanda 


47 


Samoa 


29 


San Marino 


40 


Sao Tome and Principe 


10 


Saudi Arabia 


6 


Senegal 


61 


Serbia 


64 


Serbia and Montenegro 


23 


Seychelles 


19 


Sierra Leone 


43 


Singapore 


9 


Slovakia 


12 


Slovenia 


7 


Solomon Islands 


5 


Somalia 


52 


South Africa 


6 


South Korea 


4 


Spain 


7 


Sri Lanka 


28 
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Country 


Adjusted refusal rate 


St. Kitts and Nevis 


21 


St. Lucia 


27 


St. Vincent and The Grenadines 


23 


Sudan 


34 


Suriname 


11 


Swaziland 


19 


Sweden 


8 


Switzerland 


7 


Syria 


36 


Tajikistan 


30 


Tanzania 


21 


Thailand 


17 


The Bahamas 


5 


The Gambia 


57 


Timor-Leste 





Togo 


48 


Tonga 


45 


Trinidad and Tobago 


20 


Tunisia 


24 


Turkey 


15 


Turkmenistan 


49 


Tuvalu 


12 


Uganda 


43 


Ukraine 


38 


United Arab Emirates 


5 


Unknown place of birth or stateless 


42 


Uruguay 


12 


Uzbekistan 


71 


Vanuatu 


25 


Vatican City 





Venezuela 


19 


Vietnam 


36 


Yemen 


64 


Zambia 


46 


Zimbabwe 


32 



Source: Department of State. 



includes applications for both B visas and combination B-1/B-2/Mexican Border Crossing Cards. 
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The Immigration Reform and Control Act of 1986 created the Visa Waiver 
Program as a pilot program. *In 2000, the program became permanent 
under the Visa Waiver Permanent Program Act. 2 In 2002, we reported on 
the legislative requirements to which countries must adhere before they 
are eligible for inclusion in the Visa Waiver Program. 3 In general, the 
requirements are as follows: 

• A low nonimmigrant visa refusal rate. To qualify for visa waiver status, a 
country must maintain a refusal rate of less than 3 percent for its citizens 
who apply for business and tourism visas. If DHS certifies that it has met 
certain requirements under the 9/11 Act, it will have the authority to waive 
the 3 percent refusal rate requirement — currently up to a maximum of 10 
percent — provided that the country meets other security requirements. 

• A machine-readable passport program. The country must certify that it 
issues machine-readable passports to its citizens. As of June 26, 2005, all 
travelers are required to have a machine-readable passport to enter the 
United States under this program. 

• Reciprocity. The country must offer visa-free travel for U.S. citizens. 
Persons entering the United States under the Visa Waiver Program must 

• have a valid passport issued by the participating country and be a national 
of that country; 4 

• be seeking entry for 90 days or less as a temporary visitor for business or 
tourism; 

• have been determined by CBP at the U.S. port of entry to represent no 
threat to the welfare, health, safety, or security of the United States; 



'Pub. L. No. 99-603. 
Tub. L. No. 106-396. 

3 GAO, Border Security: Implications of Eliminating the Visa Waiver Program, 
GAO-03-38 (Washington, D.C.: Nov. 22, 2002). 

4 A11 passports issued to visa waiver travelers after October 26, 2006, must be electronic. 
Travelers with passports issued after the deadline that do not meet these requirements 
must obtain a visa from a U.S. embassy or consulate overseas before departing for the 
United States. 
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• have complied with conditions of any previous admission under the 
program (e.g., individuals must have stayed in the United States for 90 
days or less during prior visa waiver visits); 

• if entering by air or sea, possess a round-trip transportation ticket issued 
by a carrier that has signed an agreement with the U.S. government to 
participate in the program, and must have arrived in the United States 
aboard such a carrier; and 

• if entering by land, have proof of financial solvency and a domicile abroad 
to which they intend to return. 
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Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 



US. Department of Homeland Security 

Washington. DC 20528 



Homeland 
Security 



August 27, 2008 



Mr. Jess T. Ford 

Director, International Affairs and Trade 
U.S. Government Accountability Office 
441 O Street, N.W. 
Washington, D.C. 20548 

Dear Mr. Ford: 

RE: Draft Report GAO-08-967, Visa Waiver Program: Actions Needed to 
Improve Management of Expansion Process and Assess and Mitigate 
Program Risks (GAO Job Code 320540) 

The Department of Homeland Security (DHS or the Department) appreciates the 
opportunity to review and comment on the draft report referenced above. 

The report is broadly supportive of the Department's efforts to date. It acknowledges that 
DHS has achieved several significant security enhancements during the expansion process. 
It also concludes that DHS has fully implemented the majority of the recommendations 
from the 2006 U.S. Government Accountability Office (GAO) report thereby improving 
the Department's ability to assess and mitigate program risks. Moreover, many of its 
recommendations are consistent with our current approach, and we expect to be able to 
implement them. In fact, the Department began, even before the report was drafted, to 
address several of these issues. We also believe that the steps the Department has taken to 
implement the security provisions mandated by the "Implementing the 9/1 1 Commission 
Recommendations Act of 2007," P.L. 109-13 (9/11 Act) will ensure that the Visa Waiver 
Program (VWP) continues to be appropriately structured to assess and mitigate program 
risks and to adapt to evolving travel needs and security standards. 

The following details the Department's response to issues raised in the report particularly 
with respect to GAO's conclusions and recommendations. 

GAO states that the executive branch is moving quickly to expand the Visa Waiver 
Program, but DHS has not followed a transparent process. 

The report does not acknowledge sufficiently the dynamic and fluid nature of the VWP 
expansion process. At various points over the past year, DHS has had to adjust the 
schedule and manner of engagement to expand and modernize the VWP in response to 
events. As evidenced by the following information, DHS made these adjustments in as 



www.dhs.gov 
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See comment 1 . 



transparent a manner as possible under the circumstances. In addition, DHS responded 
promptly and favorably to all Congressional requests for information and briefings. 

DHS did not follow its own November 2007 standard operating procedures (SOPs), which 
set forth the key milestones that DHS and aspiring countries must meet before countries 
are admitted into the program. 

DHS agrees that it did not precisely follow the November 2007 SOPs (which have since 
been updated). Nevertheless, the Visa Waiver Program Office (VWPO) staff followed a 
logical and transparent process for expansion of the program. The VWPO initially 
created the SOP as an internal document to assist program staff. It was not intended as 
formal guidance; nor was it meant for a wider audience. Moreover, VWPO staff 
understood that the procedures were subject to change should circumstances warrant. In 
fact, the SOP is normally updated after the completion of a country review cycle to 
account for relevant developments and lessons learned. 

State, Justice, and U.S. Embassy officials stated that DHS created confusion among 
interagency partners and aspiring Visa Waiver Program countries. 

DHS has successfully mitigated any confusion caused by a fluid and dynamic expansion 
process in the following ways: technical briefings for each of the aspirant countries to 
explain the new requirements and the designation process; regular communication with 
U.S. embassy personnel, DHS offices/personnel overseas, State and Justice offices with 
equities in the VWP, and foreign government representatives; and numerous staff and 
high-level meetings with State, Justice, and aspirant country officials who are partners in 
the expansion process. 

U.S. Embassy officials in several aspiring countries told us that it had been difficult to 
explain the expansion process to foreign counterparts and manage their expectations. 

DHS headquarters officials have made and continue to make significant and successful 
efforts to communicate next steps in VWP modernization and expansion to various DHS 
and U.S. embassy personnel as well as to representatives from the embassies of current 
and aspirant VWP countries in Washington, D.C. The VWPO is in near-daily contact with 
the Department of State 's Bureau of Consular Affairs, the designated contact point for 
VWP issues, as well as with multiple consular sections overseas. More formally, DHS sent 
regular email updates on VWP reform efforts to U.S. embassies in aspiring countries and 
held a number of teleconferences with affected posts to discuss current developments in the 
VWP. Finally, DHS held three high-level informational meetings with the embassies of 
current VWP and "Road Map" countries between March 2008 and July 2008, to explain 
the U.S. government's approach to VWP modernization and expansion and sent a number 
of email announcements to the same audience. 

State officials said that it was difficult to explain to countries with fiscal year 2007 refusal 
rates below 10 percent that have signaled interest in joining the program (Croatia, Israel, 
and Taiwan) why DHS is not negotiating with them, given that DHS is negotiating with 
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See comment 3. 



several countries that had visa refusal rates above 10 percent (Hungary, Latvia, Lithuania, 
and Slovakia). 

As GAO mentions in its report, State Department and DHS formulated a list of 13 
countries with whom the U.S. government planned to engage as it sought to expand the 
Visa Waiver Program, called the "Road Map Initiative. " The State Department and DHS 
formulated the list on the basis of a variety of factors, including the likely impact of a 
country's entry on the law enforcement, national security, and immigration interests of the 
United States; travel patterns; and whether the country already offered U.S. citizens visa- 
free travel privileges. As State Department personnel are well aware, a low visa refusal 
rate alone was not sufficient basis for inclusion in the "Road Map. " Furthermore, in 
White House-led policy discussions including all agencies it was agreed that due to 
workload management issues the focus this year would remain on identified Roadmap 
countries. 

GAO states that DHS has not fully developed tools aimed at assessing and mitigating risks 
of the Visa Waiver Program noting that 

a. DHS must certify that it can verify the departure of not less than 97 percent of 
foreign nationals exiting U.S. airports; 

b. DHS must certify that an Electronic System for Travel Authorization for screening 
visa waiver travelers in advance of their travel is "fully operational;" 

c. For DHS to maintain its authority to admit certain countries into the program, the 
9/11 Act requires that the air exit system also incorporate biometric indicators 
(such as fingerprints) by July 1, 2009. However, DHS will likely face difficulties 
implementing this program due, in part, to opposition from the airline industry. 

The GAO 's claim that DHS has not fully developed the tools to assess and mitigate risks in 
the VWP is premature as it rests on incomplete information regarding the status of both 
the biographic and biometric air exit systems and the Electronic System for Travel 
Authorization (ESTA). As of the date of the draft report, these requirements have not yet 
been completely met; the Department has not claimed otherwise. On the contrary, DHS 
has consistently stated its intention to certify later in 2008 both that an air exit system is in 
place that can verify the departure of not less than 97% of foreign nationals who exit 
through U.S. airports and that ESTA is fully operational. Similarly, the Department 
expects to implement a biometric exit system as required by the 9/11 Act, despite 
significant resistance both on Capitol Hill and in the private sector. Overall, GAO's 
finding at best reflects the state of the VWP program in July 2008, prior to the 
implementation of the new requirements. For example, ESTA was made available to VWP 
travelers on a voluntary basis on August 1, 2008, the week after the draft GAO report was 
released. The rollout has been smooth and successful— with more than 50,000 
applications processed to date— and the Department continues to work with the 
Departments of State and Commerce, as well as the travel and tourism industries, on 
outreach efforts. Therefore, the draft report presents outdated information that does not 
reflect the current state of the VWP or the publicly announced implementation dates for 
the 9/11 Act security enhancements. 
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GAO states that DHS does not fully consider countries' overstay rates when assessing 
illegal immigration risks in the Visa Waiver Program. 

Neither the VWP statute nor regulations require that DHS consider a country's overstay 
rates when determining the eligibility of a country to join the VWP. A VWP member 
country's overstay rate would, however, be considered as a factor to determine a country's 
continued eligibility for participation in the Program. Countries ' overstay rates also may 
be considered as a factor to determine whether a country is eligible for VWP membership 
based on a waiver of the low nonimmigrant refusal rate requirement. However, waiver 
under that provision (8 U.S.C. § 1187(c)(8)) is not possible until the 97 percent air exit 
system is certified and the Secretary, jointly with the Secretary of State, establishes the 
maximum visa overstay rate. To date, DHS has not formally relied on overstay data 
during country assessments because of weaknesses in the quality of the relevant data. 
Nevertheless, DHS agrees that overstay information should be developed to assess and 
mitigate risks, and has been working to remedy these data problems and develop overstay 
rates for foreign nationals arriving in the United States. Based on its preliminary analysis, 
the Department believes that the current data will soon be reliable enough to use to inform 
its country assessments. 

GAO states that DHS has implemented many recommendations from the 2006 report, but 
has not fully implemented others. GAO asserts that DHS has "partially implemented" the 
following: 

a. Create real-time monitoring arrangements, including the identification of visa waiver 

points of contact at U.S. embassies, for all 27 participating countries; and establish 
protocols, in coordination with appropriate headquarters offices, for direct 
communications between points of contact at overseas posts and DHS's Visa 
Waiver Program Office. 

DHS has fully implemented this recommendation. The VWPO monitors both open source 
information and classified intelligence relating to VWP countries on a daily basis. The 
VWPO has established points of contact (POCs) at U.S. Embassies and Consulates in the 
27 participating countries, as well as 13 roadmaps, to include Consular Section officials, 
Immigration and Customs Enforcement (ICE) Attaches, Customs and Border Protection 
(CBP) Attaches, U.S. Citizenship and Immigration Services (USCIS) Attaches, and Legal 
Attaches. The VWPO communicates directly with these officials (as well as with Consular 
Affairs in Washington) and utilizes more formal tasking processes with the appropriate 
headquarters offices when necessary. For example, the VWPO distributes formal requests 
for information (RFIs) to ICE, CBP, USCIS, State, and Justice headquarters offices before 
a VWP site-visit is conducted. Many of the questions contained in these RFIs are for 
embassy personnel to answer. 

b. Require periodic updates from points of contacts at posts in countries where there 
are law enforcement or security concerns relevant to the Visa Waiver Program. 
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See comment 6. 



DHS has fully implemented this recommendation. The VWPO actively engages POCs at 
U.S. Embassies and Consulates to augment its continual monitoring process. In addition, 
the VWPO receives— via appropriate channels— frequent updates on law enforcement and 
security concerns from the Intelligence Community. 

c. Require that all Visa Waiver Program countries provide the United States and 
Interpol with non-biographical data from lost and stolen issued and blank passports. 

Several VWP countries already report this data to the United States, either directly or 
through Interpol or the Regional Movement Alert System. Moreover, pursuant to an 
agreement between the U.S. National Central Bureau and the Department, the VWPO 
receives data on lost and stolen passport reporting to Interpol and engages countries as 
appropriate. As part of DHS 's efforts to expand and modernize the VWP, the Department 
is requiring current members to sign Memoranda of Understanding (MOU). Among its 
other provisions, the MOU commits signatories to report to Interpol or otherwise make 
available to the United States Government information about lost and stolen issued and 
blank passports. Eight aspirant countries have signed MOUs to date. DHS has supplied 
templates of the MOU to all current VWP countries in preparation for negotiations and is 
in active negotiations with several of them. 

GAO quotes DHS Assistant Secretary for Policy Development Richard Barth as 
follows: "The Department chose to include previous departures and changes of 
immigration status records in its methodology because this method allowed the department 
to achieve a match rate of 97 percent or greater." 

The quote attributed to Assistant Secretary Barth is inaccurate. As DHS has made clear 
on several occasions, it has not decided on a final methodology to verify the departure of 
not less than 97 percent of foreign nationals exiting U.S. airports. As noted above, the 
Department intends to make this certification later this year consistent with the statutory 
requirement. 

Recommendations and Action Taken or Planned 

The U.S. Government Accountability Office makes four recommendations in this draft 
report to improve the management of the Visa Waiver Program and better assess and 
mitigate risks: 

1. Establish a clear process, in coordination with the Departments of State and Justice, 
for program expansion that would include the criteria used to determine which 
countries will be considered for expansion and timelines for nominating countries, 
security assessments of aspiring countries, and negotiation of any bilateral 
agreements to implement the program's legislative requirements. 

DHS and State are currently working to create procedures so that future candidate 
countries are selected and designated in as transparent and uniform manner as possible 
and that expectations are appropriately managed during the process. That being said, 
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program expansion criteria can not be boiled down to a simple "check-list. " Potential 
candidate countries will be evaluated based on a variety of factors, including the likely 
impact of their designation on the law enforcement, national security, and immigration 
interests of the United States; travel patterns; and the extent of security cooperation with 
the United States. 

2. Designate an office with responsibility for developing overstay rate information for 
the purposes of monitoring countries' compliance with the statutory requirements 
of the Visa Waiver Program. 

To date, three DHS offices have collaboratively developed overstay rate estimates based 
on their roles in the process; CBP Office of Field Operations, US-VISIT, and the Office of 
Immigration Statistics. DHS is currently assessing the feasibility and effectiveness of 
designating a single office to assume this responsibility. 

3. Direct that office and other appropriate DHS components to explore cost effective 
actions necessary to further improve, validate, and test the reliability of overstay 



DHS is currently taking several steps to improve the accuracy and reliability of the 
overstay data. For example, CBP will continue to audit carrier performance and work 
with airlines to improve the accuracy and completeness of data collection. The accuracy 
of the overstay rate estimates also depends on the precision of the matching algorithms. 
US-VISIT expects to receive a preliminary evaluation of the current matching algorithms 
with possible recommended improvements from the Lawrence-Livermore National Labs 
this fall. 

4. Direct the Visa Waiver Program Office to request an updated, validated study of 
estimated overstay rates for current and aspiring Visa Waiver Program countries 
and determine the extent to which additional research and validation of the data is 
required to help evaluate whether particular countries pose a potential illegal 
immigration risk to the United States. 

The VWPO— working with the Office of Immigration Statistics— has requested estimated 
overstay rates for current and aspiring VWP countries. The VWPO has further requested 
additional validation of these estimates. Based on its preliminary analysis of data 
provided by US-VISIT, the Department believes that the current data will soon be reliable 
enough to inform VWP country assessments. 



data; 



Sincerely, 




Jerald E. Levine 
Director 

Departmental GAO/OIG Liaison Office 
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Following are GAO's comments on the Department of Homeland 
Security's letter dated August 27, 2008. 



q^q Qojjijjigj-|^g 1- We disagree that the department followed a transparent process for 

expansion of the program. As we state in our report, State and Justice 
officials told us that the lack of a transparent timeline and 
requirements for Visa Waiver Program expansion has led to confusion 
among U.S. agencies in headquarters' offices and at U.S. embassies 
overseas, as well as foreign governments seeking to join the program. 
Moreover, absent clear direction from DHS, U.S. embassy officials in 
several aspiring countries told us that it had been difficult to explain 
the expansion process to their foreign counterparts and manage their 
expectations about when those countries might be admitted into the 
Visa Waiver Program. Therefore, we recommend in this report that 
DHS establish a clear process, in coordination with State and Justice, 
for program expansion. DHS noted that it is currently working to 
create procedures so that future candidate countries are selected and 
designated in as transparent and uniform a manner as possible and 
expectations are appropriately managed during the process. 



2. Aside from the 13 Road Map countries identified in 2005, State officials 
told us that they lacked a clear rationale to explain to other aspiring, 
non-Road Map countries with refusal rates under 10 percent (Croatia, 
Israel, and Taiwan) that they will not be considered in 2008 due to the 
executive branch's plans to expand the program first to South Korea 
and countries in Central and Eastern Europe. DHS noted that it is 
currently working to create procedures so that future candidate 
countries are selected and designated in as transparent and uniform a 
manner as possible and expectations are appropriately managed 
during the process. 

3. We have updated the report to indicate that ESTA began accepting 
voluntary applications from visa waiver travelers on August 1, 2008. 
However, DHS does not anticipate that ESTA authorizations will be 
mandatory for visa waiver travelers until after January 12, 2009. As we 
state in our report, and as DHS noted, the department has not yet 
certified that it can verify the departure of not less than 97 percent of 
foreign nationals exiting U.S. airports, or that an Electronic System for 
Travel Authorization (ESTA) for screening visa waiver travelers in 
advance of their travel is "fully operational." Moreover, DHS has not 
yet implemented a biometric air exit system at U.S. airports. Thus, 
DHS has not yet fully developed the tools to assess and mitigate risks 
in the Visa Waiver Program. 
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4. In July 2006, we reported that DHS needed to improve its 
communication with officials at U.S. embassies so it could 
communicate directly with officials best positioned to monitor 
compliance with the program's requirements, and report on current 
events and issues of potential concern in each of the participating 
countries. Therefore, we recommended that DHS establish points of 
contact at U.S. embassies and develop protocols to ensure that the 
Visa Waiver Program Office receives periodic updates in countries 
where there are security concerns. As we note in this report, the Visa 
Waiver Program Office has recently begun communicating and 
disseminating relevant program information regularly with U.S. 
embassy officials at Visa Waiver Program posts. However, despite our 
requests during the course of this review — and again following our 
receipt of DHS's formal comments on the draft of this report — the 
department has not provided us with sufficient documentation to 
demonstrate that it has established points of contact at U.S. embassies 
for all 27 participating countries or established protocols for 
communications between these contacts and the Visa Waiver Program 
Office. Furthermore, the department has not provided us with 
documentation to demonstrate that established points of contact are 
reporting periodically to the Visa Waiver Program Office. Therefore, 
we cannot conclude that these 2006 recommendations are fully 
implemented. 

5. DHS noted that it has not yet signed memorandums of understanding 
(MOU) with any of the 27 current Visa Waiver Program countries. 
Because the MOUs will commit all signatories to report to Interpol or 
otherwise make available to the United States information about lost 
and stolen blank and issued passports, this recommendation will 
remain open until all MOUs are finalized. 

6. To verify the departure of not less than 97 percent of foreign nationals 
exiting U.S. airports, DHS reported to us in December 2007 that it will 
match records, reported by airlines, of visitors departing the country 
with the department's existing records of any prior arrivals, 
immigration status changes, or prior departures from the United 
States. In January 2008, the Assistant Secretary for Policy 
Development made this statement, which corroborated data that we 
received from US- VISIT in late October 2007. At the time of our 
February 2008 testimony, 1 DHS confirmed to us that it planned to 



^AO, Visa Waiver Program: Limitations with Department of Homeland Security's Plan 
to Verify Departure of Foreign Nationals, GAO-08-458T (Washington, D.C.: Feb. 28, 2008). 



Page 49 



GAO-08-967 Visa Waiver Program 



Appendix IV: Comments from the Department 
of Homeland Security 



employ a methodology that begins with departure records; however, as 
DHS indicated in its written comments on a draft of this report, it has 
still not decided on a final methodology. DHS has not provided us with 
information on any other options that it might be considering to meet 
this provision. Furthermore, the department has not explained how 
and when it intends to validate these data. 



Page 50 



GAO-08-967 Visa Waiver Program 



Appendix V: Comments from the Department 
of Justice 



2/ 



U.S. Department of Justice 

National Central Bureau - INTERPOL 



Wmhinxinn. D.C 305 JO 



August 26, 2008 



Jess T. Ford 
Director 

International Affairs and Trade 
U.S. Government Accountability Office 
441 G. Street, NW 
Washington, DC 20548 



Dear Mr. Ford: 



Thank you for the opportunity to review the final draft of the Government 
Accountability Office (GAO) report entitled "Visa Waiver Program: Actions Needed to 
Improve Management Expansion Process and Assess and Mitigate Program Risks." The 
draft was reviewed by the US National Central Bureau of Interpol (USNCB), and 
relevant components of the Department of Justice (DOJ). This letter constitutes the 
USNCB 's formal comments. I request that the GAO include this letter in the final report. 

As noted in the report, DOJ and the Departments of Homeland Security (DHS) 
and State (DoS) have collaborated extensively to bring international lost and stolen 
passport data, provided by Interpol, to United States (US) ports-of-entry and the US law 
enforcement community. Use of the Interpol Lost and Stolen Travel Document Database 
(SLTD) in the United States continues to demonstrate significant and sustained results in 
thwarting the misuse of lost and stolen passports by criminals seeking to fraudulently 
enter the US. 



USNCB, in collaboration with DHS and DoS, played a key role in the 
development of international standard operating procedures for the reporting of lost and 
stolen passport data to Interpol. The United States is presently in the top tier of Interpol 
member countries for both reporting and consulting of this data. We believe that the 
establishment, by Interpol, of a formal, transparent and accurate monitoring system for 
country reporting to the SLTD would greatly benefit the overall success of the system 
and bolster DHS' Visa Waiver Program. Such a mechanism would allow the US and 
other participating countries to track reporting compliance, identify discrepancies and 
eliminate the need for duplicate reporting. 
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Page Two 

Based on the success of the Advance Passenger Manifest (APIS)-I nter P l 
interface, currently in place at all US ports-of-entry, the USNCB engaged in a 
cooperative arrangement with DHS to incorporate SLID database checks for the 
Electronic System for Travel Authorization (ESTA) program. The Interpol-ESTA 
interface was established in May 2008 and tested in a production environment in July 
2008, prior to the program launch earlier this month. At this time, I am happy to report 
that the ESTA-Interpol system is functioning seamlessly and has already resulted in 
automated denials of applications involving passports known to the Interpol lost/stolen 
database. 

We appreciate the efforts of you and your staff in highlighting the work of the 
Department and Interpol in this important program. 



Sincerely, 




Martin Renkiewicz 
Director 



cc: Vicky Caponiti, Audit Liaison 
US Department of Justice 

Ronald K. Noble 
Interpol Secretary General 
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